Tag: Forensics

MalChela v3.0: Case Management, FileMiner, and Smarter Triage

DFIR, Forensics, hashing, Malware, Memory Analysis, Rust, Triage, yara

With the release of MalChela v3.0, I’m introducing features that shift the focus from tool-by-tool execution to a more structured investigative workflow. While the core philosophy of lightweight, file-first analysis remains unchanged, this version introduces smarter ways to manage investigations, track findings, and automate common analysis patterns, all with minimal fuss.

In this post, I’ll walk through the new Case Management system, the replacement of MismatchMiner with FileMiner, and the ability to identify and launch suggested tools — even in batch — based on file characteristics. These changes aim to reduce friction in multi-tool workflows and help analysts move faster without losing visibility or control.

Cases: A Lightweight Way to Stay Organized

Until now, MalChela has operated in an ephemeral mode. You selected a tool, pointed it at a file or folder, and reviewed the output. Any saved results would be grouped by tool, but without much context.

Cases change that. In v3.0, you can start a new case from a file or folder — and everything from that point forward is grouped under that case. Tool outputs are saved to a dedicated case folder, file hashes are tracked, and metadata is preserved for review or reanalysis.

Case Management

You don’t need to create a case for every run — MalChela still supports standalone tool execution. But when you’re working with a malware sample set, an incident directory, or a disk image extract, cases give you the ability to:

  • Save tool results in a consistent location
  • Track analysis history per file
  • Reopen previous sessions with full context
  • Add notes, tags, and categorization (e.g., “suspicious”, “clean”, “needs review”)

Hello FileMiner: Goodbye MismatchMiner

The MismatchMiner tool was originally designed to surface anomalies between file names and actual content — a common trick in malicious attachments or script dropper chains. It worked well, but its scope was narrow.

FileMiner replaces it, expanding the logic to support full file-type classification and metadata inspection across an entire folder. It still flags mismatches, but now it also:

  • Detects embedded file types using magic bytes
  • Groups files by class (e.g., images, documents, executables, archives)
  • Calculates hashes for correlation and NSRL comparison
  • Extracts size, extension, and other key metadata
  • Saves both a human-readable .txt summary and a structured .json report

The output is designed to be used both manually and programmatically — which brings us to one of v3.0’s most important additions: tool suggestions.

The new FileMiner app

Suggested Tools and Batch Execution

Once FileMiner runs, it doesn’t just stop at reporting. Based on each file’s type and characteristics, it can now suggest one or more appropriate tools from the MalChela suite.  These suggestions are surfaced right in the GUI — or in the CLI if you’re running FileMiner interactively. From there, you can choose to launch the recommended tool(s) on a per-file basis or queue up several for batch execution.

This makes it much faster to pivot from triage to deeper inspection. No more switching tools manually or copying paths. You stay within the flow — and more importantly, you reduce the risk of skipping important analysis steps.

CLI and GUI Improvements Aligned

These features are available in both the CLI and GUI editions of MalChela. In the CLI, FileMiner presents an interactive table of results. You can pick a file, see its suggested tools, and choose which one to run. When you’re done, you can return to the table and continue with the next file.

The GUI extends this even further, allowing you to:

  • View and scroll through full case history
  • Run tools with live output streaming
  • Reopen previous FileMiner runs from saved reports
  • Run all suggested tools on all files with one click (if desired)

These features let you treat MalChela more like a toolbox with memory, not just a launcher.

CLI Enhancements:

The command-line interface has also received a quiet but meaningful upgrade. Tool menus are now organized with clear numeric indexes and shortcodes, making it faster to navigate and launch tools without needing to retype full names. This small change goes a long way during repetitive tasks or when working in a time-constrained triage setting.

FileMiner supports an interactive loop: after running a tool on a selected file, you’re returned to the main results table — no need to restart the scan or re-navigate the menu. This allows you to run additional tools on different files within the same dataset, making FileMiner feel more like a lightweight control center for follow-up actions. It’s a subtle shift, but one that significantly reduces friction in batch-style or exploratory workflows.

Closing Thoughts

MalChela 3.0 reflects a steady evolution — not a revolution. It’s built on real-world feedback and a desire to make forensic and malware analysis a little less scattered. Whether you’re a one-person IR team or just trying to stay organized during a reverse engineering exercise, the new case features and smarter triage capabilities should save you time.

If you’ve been using MalChela already, I think this update will feel like a natural (and welcome) extension. And if you haven’t tried it yet, there’s never been a better time to start.

Download: https://github.com/dwmetz/MalChela/releases

User Guide: https://dwmetz.github.io/MalChela/

Hashes for the Masses: Finding What Matters in a Sea of Samples

DFIR, Forensics, hashing, Malware, Rust, yara

A short while back, I released a pair of tools for building MD5 hash sets — one targeting known-good gold builds, the other designed for scanning malware corpora. The goal was simple: generate hash sets that could be used in forensics tools like Axiom Cyber to flag IOC matches during case processing.

Recently, I hit a familiar problem: I had a hash and wanted to know if that file existed in my malware library. Step one was updating my tooling to support SHA256 — the modern standard for hash sharing — and regenerating the hash sets. That part worked. I could search for a hash and confirm whether it appeared in my set.

But what if I got a match?

At that point, I realized: I had no way to correlate the match back to the original file. With ~30,000 samples in the library, “just eyeballing it” wasn’t an option.

As I’ve been coding up new tools — or revisiting earlier ones — I’ve discovered that rabbit holes have rabbit holes.

So I updated the SHA256 tool to not only generate a hash set, but also produce a .tsv lookup table mapping each hash to its full file path. This made the sets usable both in forensics platforms and for custom lookups in more ad hoc workflows. As they say: necessity is the mother of intention.

Of course, that led to another realization. I now had four hashing tools — two for MD5 (MZ and non-MZ), and two for SHA256. The “Hashing Tools” section in MalChela was getting a bit crowded.

Back to the drawing board.

The Result: Three Unified Tools

I consolidated and upgraded everything into three tools — all of which support both CLI and GUI usage.

#️⃣ MZHash (replaces mzmd5)

• Uses YARA to recursively scan for files with an MZ header (i.e., Windows executables and DLLs)

• Generates one hash file per selected algorithm: MD5, SHA1, SHA256

• Also creates a .tsv lookup file for each, mapping hashes to paths

cargo run -p mzhash /directory/to/scan -- -a MD5 -a SHA1 -a SHA256

Via GUI, you can browse to the folder and check boxes for each algorithm.

🌐 XMZHash (replaces xmzmd5)

• Uses YARA to skip over files with MZ, ZIP, or PDF headers

• Hashes everything else — ideal for surfacing Linux, Mac, or unusual samples from a mixed malware corpus

• Also supports .tsv lookup file generation

cargo run -p xmzhash /directory/to/scan -- -a MD5 -a SHA1 -a SHA256

The idea: hash what’s not obviously Windows, document-related, or un-extracted samples.

XMZHash

🔍 HashCheck

Okay, so naming might not be my strong suit. But this tool’s direct.

• Provide a hash value and a .txt or .tsv hash set

• It checks for matches, and if you’re using a .tsv, it shows the file path of the match

• Great for live triage, corpus hunting, or checking known-bads

cargo run -p hashcheck ./hashes.tsv 44d88612fea8a8f36de82e1278abb02f
Hash Check

In Summary

MalChela 2.2.1 expands its hashing toolkit with the introduction of HashCheck, MZHash, and XMZHash — giving analysts faster ways to flag known-good, isolate unknowns, and build actionable sets. In this release, we’ve also said goodbye to legacy tools, standardized output saving, and doubled down on clarity across both CLI and GUI workflows.

Download: https://github.com/dwmetz/MalChela/releases

User Guide: https://dwmetz.github.io/MalChela/

CyberPipe v5.1 – Streamlined Profiles, Better Flexibility

DFIR, Forensics, PowerShell, RAM, Triage, USB

CyberPipe v5.1 is out with a few targeted improvements to make live response a bit smoother.

What’s New:

  • Collection profiles can now be passed directly as arguments using -CollectionProfile. No need to modify the script or hardcode anything — just run with the profile you need.
  • Improved support for saving to network shares, ideal for remote collections triggered by EDR.
  • Better error handling and logging, including clearer messages when tools are missing or when BitLocker key recovery fails.

The default profile still covers the most common triage needs:

✔️ Memory dump (RAM)

✔️ Pagefile

✔️ Volatile data (network config, hives, running procs)

✔️ System artifacts

But now, you can swap that out on the fly:

Usage Examples:

.\CyberPipe.ps1 ## default profile, capture RAM, Pagefile, Volatile and System Files

.\CyberPipe.ps1 -CollectionProfile RAMOnly ## just the RAM

.\CyberPipe.ps1 -CollectionProfile RAMSystem ## just the RAM and System Files (triage lite)

.\CyberPipe.ps1 -CollectionProfile RAMPage ## RAM & Pagefile

.\CyberPipe.ps1 -CollectionProfile Volatile ## Just Volatile data

Useful for tailoring collections based on available time, scope, or system stability — especially during incident response where conditions change quickly.

CyberPipe still captures memory with DumpIt or RAM Capture, grabs volatile system data, checks for encryption, and recovers the BitLocker key when possible. But now it’s just a bit easier to tailor to the job at hand — whether you’re responding interactively or invoking it remotely via EDR integration.

As always, no dependencies beyond what’s in the Tools folder, and no assumptions about the system you’re collecting from.

See the full changelog and usage notes in the README on GitHub.

MalChela v2.1 Released: Smoother Workflows, Easier Tool Integration

DFIR, Forensics, Malware, Rust


🧰 A Toolkit That Grows With You

Version 2.1 of MalChela, the modular digital forensics and malware analysis launcher, is now available. This release focuses on flexibility and simplicity — especially when integrating third-party tools and refining workflows between CLI and GUI.

Whether you’re testing suspicious files, generating YARA rules, or examining malware indicators from different sources, the updated interface helps you move fluidly from one tool to another — without losing your place or rewriting commands.


🔄 Run, Re-run, Refine

One of the most helpful improvements in 2.1 is the ability to quickly rerun tools with updated arguments. There’s no need to backtrack or manually rebuild command lines. Just update the Arguments field in the GUI, click Run, and MalChela will handle the rest.

If you’re pivoting between tools like mstrings, pdf-parser, or capa, the consistent interface lets you switch input, adjust flags, and review results in one console — no clutter, no confusion.


🔌 Integration Made Easy

You can now seamlessly add external tools — including Python scripts, native binaries, or custom Rust programs — using just the tools.yaml configuration file. Each tool can define:

  • Input type (file, folder, or hash)
  • Command structure
  • Where input should appear in the argument list
  • Whether it’s a script, binary, or cargo-built tool

The GUI reads these definitions and builds a dynamic interface to support them, removing the guesswork of launching external programs.


💾 One Report to Rule Them All

In past versions, you might have seen multiple output files for a single run — especially when running scripts that already saved their own logs. That’s no longer the case.

With 2.1, all tools now produce a single unified report when run through the GUI. Even scripts that don’t natively generate output will have their results captured and saved by MalChela, giving you clean, consistent documentation for every tool.


🐚 CLI Power, GUI Convenience

MalChela still supports CLI-based workflows (cargo run -p toolname) and a menu-driven terminal launcher. But the GUI now offers a refined experience for analysts who want more visibility, easier input selection, and better organization of results — without losing the precision of command-line control.


🚀 Try It Out

MalChela is open-source and free to use. You can:

🎥 A Video Tour

If you haven’t seen it yet, be sure to check out the YouTube video where I walk through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing – all in minutes.

🙏 Thank You

A huge thank you to the community of forensic analysts and developers who continue to test, refine, and inspire this project. If you have feedback, feature ideas, or tools you’d like to see integrated — reach out, submit a PR, or just let me know what’s working.